Effective date: 14 September 2026
This agreement forms part of the Terms of Service and applies where we process personal data on your behalf. It is written to meet Article 28(3) of the UK GDPR.
This is the part most likely to need a solicitor's confirmation, so our position is stated plainly.
We are the controller of your NASST account data — your email address, password hash, sign-in records and two-factor settings. We decide to collect it, and why. The Privacy Policy governs it.
We are your processor for Amazon business data we retrieve on your instruction — catalogue data, offers, fees, inventory, eligibility and Buy Box results. You decide what to look up and why; we execute it. This agreement governs it.
Most of that Amazon business data is not personal data at all. Where it is — for example a competing seller's trading name where they trade as an individual — this agreement applies to it.
Nothing here makes us a processor of buyer personal data, because NASST does not receive any. See §1.3 of the Privacy Policy.
| Subject matter | Providing the NASST sourcing and analysis service |
| Duration | While your account is open, plus the retention periods in document 7 |
| Nature and purpose | Retrieving, storing, calculating on and displaying Amazon Selling Partner data on your instruction |
| Type of personal data | Any personal data incidentally present in Amazon catalogue, offer or inventory data — principally seller trading names. No buyer data |
| Categories of data subject | Amazon sellers, including competing sellers whose public offers are shown |
| Special category data | None. NASST is not to be used to process it |
We will:
5.3.1 Process only on your instructions. We will process personal data only to provide NASST and only as you instruct, unless UK law requires otherwise — in which case we will tell you first, unless the law prohibits it.
5.3.2 Keep it confidential. Everyone with access is bound by confidentiality obligations.
5.3.3 Secure it. We will maintain appropriate technical and organisational measures under Article 32. The measures in place are set out in document 9 and summarised in §1.9 of the Privacy Policy.
5.3.4 Control sub-processors. We will not engage a new sub-processor without telling you at least 30 days beforehand, giving you the chance to object. If you reasonably object we will either not proceed or let you terminate without penalty, refunding any unused prepaid period. Every sub-processor is bound to obligations no weaker than these. The current list is document 6.
5.3.5 Help with data subject requests. If someone exercises a data subject right against you and it concerns data we hold for you, we will help you respond, taking into account what we can technically do.
5.3.6 Help with your own compliance. We will provide reasonable assistance with data protection impact assessments, prior consultations and Article 32–36 obligations.
5.3.7 Report breaches quickly. We will tell you without undue delay and in any event within 24 hours of becoming aware of a personal data breach affecting your data, with the detail you need for your own reporting.
The 24-hour commitment is deliberately shorter than the UK GDPR's 72-hour regulatory deadline, because Amazon's Data Protection Policy requires us to notify within 24 hours and there is no sense holding you to a slower standard than we hold ourselves.
5.3.8 Delete or return it. On termination we will delete personal data processed on your behalf, on the schedule in document 7. We will confirm deletion on request.
5.3.9 Demonstrate compliance. We will make available the information needed to show we meet these obligations, and allow audits under §5.5.
You will:
Protection Policy or Amazon's Acceptable Use Policy
user with your password from you
You may audit our compliance once in any 12-month period, or after a breach affecting your data, on 30 days' written notice. Audits take place in business hours, must not disrupt the service, and are at your cost.
We may satisfy an audit with a current third-party assessment covering the same scope. In practice, for a service of this size, our security documentation and a written questionnaire will usually answer more than a site visit would.
Where a sub-processor is outside the United Kingdom, the safeguard is named in the Sub-processor List (document 6). In summary: our hosting, our email sending, the Amazon endpoint we use, Keepa and the barcode databases all sit inside the EEA and are covered by the UK's adequacy decision, so there is no restricted transfer. Payment is contracted with Stripe's Irish entity, again within the EEA; Stripe's own onward transfer to its United States company is governed by Stripe's data processing agreement, which applies whichever safeguard is required. The inbound mailbox stores content within Microsoft's UK or EU region, with the UK International Data Transfer Agreement covering its United States reseller. The full analysis is in our Transfer Risk Assessment (internal record 15).
Liability under this agreement is subject to the limits in §2.7 of the Terms of Service, except where data protection law does not permit that.
If this agreement conflicts with the Terms of Service on the processing of personal data, this agreement wins.
This agreement lasts as long as we process personal data on your behalf. §5.3.8 and §5.3.9 survive its end.